Ubuntu.comUB:CVE-2018-12556CVE-2018-12556
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.007 Low
EPSS
Percentile
80.3%
The signature verification routine in install.sh in yarnpkg/website through
2018-06-05 only verifies that the yarn release is signed by any (arbitrary)
key in the local keyring of the user, and does not pin the signature to the
yarn release key, which allows remote attackers to sign tampered yarn
release packages with their own key.
Notes
| Author | Note |
|---|---|
| seth-arnold | It appears this is about the install.sh that is run via a curl url |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 20.04 | noarch | node-yarnpkg | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | node-yarnpkg | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | node-yarnpkg | < any | UNKNOWN |
References
packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
seclists.org/fulldisclosure/2019/Apr/38
github.com/RUB-NDS/Johnny-You-Are-Fired
github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
github.com/yarnpkg/website/commits/master
launchpad.net/bugs/cve/CVE-2018-12556
neopg.io/blog/yarn-signature-bypass/
nvd.nist.gov/vuln/detail/CVE-2018-12556
security-tracker.debian.org/tracker/CVE-2018-12556
www.cve.org/CVERecord?id=CVE-2018-12556
www.openwall.com/lists/oss-security/2019/04/30/4
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.007 Low
EPSS
Percentile
80.3%